Yes, where EU data subjects are involved. Under Article 3, GDPR applies extraterritorially — processing the personal data of individuals in the EU brings a non-EU firm into scope regardless of where it sits. Othello does not treat its Bangkok domicile as an exemption. EU-facing engagements are run to GDPR standard, with the EU → Thailand transfer handled under Standard Contractual Clauses.

A data processor. Othello processes personal data inside documents on the documented instructions of the client, who is the controller and determines the purposes. This role allocation is recorded in the engagement and the Article 28 Data Processing Agreement, and it dictates the obligations Othello accepts — confidentiality, security, sub-processor control, breach notification, audit, and deletion.

Through Standard Contractual Clauses, not adequacy. Thailand is not on the EU’s list of adequate countries, so EU → Thailand transfers run on the modernised SCCs (Decision (EU) 2021/914) incorporated into the DPA, accompanied by a Transfer Impact Assessment and documented supplementary measures (encryption, access control, minimisation). Othello will not claim Thailand is “adequate” — it documents the actual lawful mechanism the regulation requires for a non-adequate third country.

After the Schrems II ruling, SCCs alone are not enough — the data exporter must assess whether the destination country offers protection essentially equivalent to the GDPR, and add supplementary measures where it falls short. That assessment is the Transfer Impact Assessment. For EU-origin engagements, the TIA documents the measures — encryption with Othello-held keys, least-privilege access, in-house processing, minimisation — and is reassessed at least annually.

Yes. Every EU-facing engagement can run under an Article 28 DPA, available on request and issued under mutual NDA. The DPA records the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subject, the controller’s instructions, and Othello’s obligations — with the SCCs incorporated for the transfer. The DPA is the instrument; SCCs sit inside it.

No — not for substantive client content. Othello does not route personal data inside client documents through consumer LLM endpoints or unscreened third-party machine-translation services. Content is processed within Othello-controlled infrastructure by the named bench. Silent data egress to free translation tools is the single most common GDPR failure in the translation market — and the one Othello is built to avoid.

As a processor, Othello’s obligation under Article 33 is to notify the controller without undue delay on becoming aware of a breach — so the controller can meet its own 72-hour supervisory-authority deadline. Othello runs a documented incident-response procedure: detection, containment, assessment, controller notification, remediation, and a recorded post-incident review.

As processor, Othello does not field requests directly from data subjects — it assists the controller in honouring them (Articles 15–21: access, rectification, erasure, restriction, portability, objection). On the controller’s instruction, Othello promptly retrieves, corrects, extracts, or deletes the relevant material from Othello-controlled infrastructure and records the action in the audit-trail.

Only for the agreed retention window, then secure deletion with written confirmation (Article 5 storage limitation). The window is set in the DPA. On engagement close or controller instruction, Othello deletes or returns the data and confirms in writing, with the lifecycle recorded in the audit-trail. No retention “just in case.”

PDPA is Othello’s home regime; GDPR applies to EU-facing work. Thailand’s PDPA was modelled on GDPR, so the two map closely — Othello runs one handling discipline (in-house processing, encryption, minimisation, retention control, breach response) calibrated to satisfy the stricter of the two on any point. This sits inside the firm’s founding standard — established 2020 on US government contracts under FAR-grade verification and NDA-from-first-email confidentiality. See PDPA Compliance. Email [email protected] or call +66 02-859-2145.